Phylum, The Software Supply Chain Security Company, announced the ability to integrate Phylum directly with artifact repositories and package managers to vet open-source software packages before they enter an organization or developer workstation. Phylum can now be deployed at multiple phases, early in the development lifecycle to block malicious packages and implement acceptable use policies based on an organization’s specific threat model.
“Think of Phylum like a firewall for open-source software packages, providing a layer of defense between the open-source ecosystem and the software your customers trust you to keep secure,” said Aaron Bray co-founder and CEO of Phylum.
Phylum users benefit from its powerful, automated analysis engine that reports proprietary findings instead of relying on manually curated lists. Phylum uses SAST, heuristics, machine learning and artificial intelligence to detect and report zero-day findings. Users know more risks, sooner and earlier in the development lifecycle for the strongest software supply chain defense.
“Because Phylum’s analysis engine looks at third-party code as soon as it’s published into the open-source ecosystem, we are uniquely positioned to inform organizations of the most threats, at pace and at scale,” said Louis Lang, co-founder and CTO at Phylum. “For example, public lists like OSV, which does its best to crowdsource the identification of malicious open-source packages has reported a little over 25,000 malicious packages while Phylum has found more than 200,000.”
Also Read: Keysight Enhances Software Strategy with Synopsys Acquisition
Users can easily set and enforce acceptable use policies at the perimeter of the open-source ecosystem by leveraging the Phylum Policy Library to choose criteria based on specific indicators, attack types or regulatory guidelines, or create custom policy using Open Policy Agent (OPA). The Phylum Policy Library allows users to toggle on the blocking of critical vulnerabilities, attacks like typosquats, obfuscated code and dependency confusion, copyleft licenses, and more. Additionally, the flexibility of OPA enables customers to develop incredibly flexible and granular policies that fit their unique needs, based on any attribute related to the open-source software.
“One customer, for example, wanted to ensure all packages they consumed were at least two weeks old. This use case was quickly satisfied by a custom policy, which took minutes to write and was deployed within three clicks to provide enterprise-wide enforcement. This option is now available in the Phylum Policy Library for any customer to use,” said Bray.
Given that for most organizations developer experience is of paramount importance, Phylum operates as seamlessly as possible. In the event a specific version of a package is non-compliant (e.g., contains a critical security vulnerability), Phylum can gracefully fallback to a compliant version of the requested package. The development process remains uninterrupted, secure software is used and a breakage is only caused if no viable alternatives exist.
SOURCE: PRWeb